Skip to content

crypto/x509: Verify on macOS does not return typed errors [1.18 backport] #57426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gopherbot opened this issue Dec 21, 2022 · 5 comments
Closed

crypto/x509: Verify on macOS does not return typed errors [1.18 backport] #57426

gopherbot opened this issue Dec 21, 2022 · 5 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.18.10

Comments

@gopherbot
Copy link
Contributor

@rolandshoemaker requested issue #56891 to be considered for backport to the next 1.18 minor release.

@gopherbot please open backport issues. This issue makes macOS behave differently from every other platform, which otherwise return consistent types for verification errors. This was an inadvertent breaking API change introduced in 1.18, and is likely causing silent issues in code that expects consistent behavior across platforms when verifying certificates. Currently working around this requires adding macOS specific code in order to catch specific verification failures.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Dec 21, 2022
@gopherbot gopherbot mentioned this issue Dec 21, 2022
Closed
@gopherbot gopherbot added this to the Go1.18.10 milestone Dec 21, 2022
@heschi heschi added the CherryPickApproved Used during the release process for point releases label Jan 4, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Jan 4, 2023
@heschi
Copy link
Contributor

heschi commented Jan 4, 2023

Ping: this issue is at risk of missing the next minor release, which will be the last for 1.18.

@heschi
Copy link
Contributor

heschi commented Jan 5, 2023

cc @golang/security

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/460896 mentions this issue: [release-branch.go1.18] crypto/x509: return typed verification errors on macOS

@gopherbot
Copy link
Contributor Author

Closed by merging 476384e to release-branch.go1.18.

gopherbot pushed a commit that referenced this issue Jan 6, 2023
@rolandshoemaker @gopherbot
[release-branch.go1.18] crypto/x509: return typed verification errors…
476384e 
… on macOS

On macOS return the error code from SecTrustEvaluateWithError, and use
it to create typed errors that can be returned from Verify.

Updates #56891
Fixes #57426

Change-Id: Ib597ce202abb60702f730e75da583894422e4c14
Reviewed-on: https://go-review.googlesource.com/c/go/+/452620
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
(cherry picked from commit c9a10d4)
Reviewed-on: https://go-review.googlesource.com/c/go/+/460896
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Heschi Kreinick <heschi@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/461176 mentions this issue: misc/cgo/testcshared: handle unsuffixed dlltool path

@golang golang locked and limited conversation to collaborators Jan 9, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.18.10
Development

No branches or pull requests
2 participants
@gopherbot @heschi